Verify state -> exchange code -> verify id_token (sig/aud/iss/exp via google-auth, nonce + email_verified here) -> session cookie -> redirect.

303 Google itself refused BEFORE issuing a code (?error=...): the user cancelled, or (far more common) the OAuth consent screen blocked the account — app still in "Testing" and the address isn't a test user, or the app is pending verification. Nothing our code can fix; we bounce the browser back to /login with a readable banner instead of a raw 400. 400 missing/forged/expired state or cookie (CSRF / replayed callback) 401 code exchange refused, or the id_token failed verification 403 Google says the email is NOT verified (no account is created/linked) 503 not configured